Data Processing Addendum
Terms governing Forzelite's processing of personal data on behalf of our customers.
Last updated: Pending legal review
1. Scope & Roles
This Data Processing Addendum (“DPA”) forms part of the agreement between Forzelite and the customer (“Customer”) for the use of the Services. For personal data submitted to the Services, the Customer acts as the controller and Forzelite acts as the processor. Where the Customer is itself a processor, Forzelite acts as a subprocessor.
2. Nature & Purpose of Processing
Forzelite processes personal data only to provide the Services and on documented instructions from the Customer, including with regard to transfers, unless required to do otherwise by applicable law. The subject matter is the provision of the strength & conditioning platform; the duration is the term of the agreement.
3. Categories of Data & Subjects
Data subjects: coaches, staff, athletes (including, where applicable, minors managed by their organization), and account administrators.
Data categories: contact and account data, training and performance data, recovery metrics, and usage data, as further described in the Privacy Policy.
4. Processor Obligations
- process personal data only on documented Customer instructions;
- ensure persons authorized to process data are bound by confidentiality;
- implement appropriate technical and organizational security measures;
- assist the Customer with data-subject requests and with security, breach-notification, and impact-assessment obligations; and
- delete or return personal data at the end of the engagement, subject to legal retention requirements.
5. Subprocessors
The Customer authorizes Forzelite to engage the subprocessors listed below to process personal data. Forzelite imposes data-protection obligations on each subprocessor that are no less protective than those in this DPA, and remains responsible for their performance. Forzelite will provide notice of intended changes to subprocessors so the Customer can object on reasonable grounds.
| Subprocessor (category) | Purpose | Location |
|---|---|---|
| Cloud infrastructure provider | Application hosting, compute, storage, and networking | United States / EU regions |
| Managed database provider | Primary application database and backups | United States / EU regions |
| Payment processor | Subscription billing and payment processing | United States |
| Transactional email provider | Account, billing, and notification emails | United States |
| Error monitoring and logging provider | Application observability and incident diagnosis | United States |
| Product analytics provider | Aggregated, privacy-respecting usage analytics | United States / EU regions |
| Customer support tooling | Support ticketing and customer communication | United States |
6. International Transfers
Where personal data is transferred outside the EEA, UK, or other regulated regions, such transfers are made under an appropriate transfer mechanism (for example, the EU Standard Contractual Clauses or UK Addendum), incorporated by reference where applicable.
7. Security Measures
Forzelite maintains encryption in transit, role-based access control, tenant-level data isolation, audit logging, and least-privilege access policies. A current description of measures is available on request.
8. Personal Data Breach
Forzelite will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data and will provide information reasonably required for the Customer to meet its notification obligations.
9. Audits
Forzelite will make available information necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, subject to reasonable confidentiality and security constraints.
10. Return & Deletion
On termination of the Services, Forzelite will, at the Customer's choice, delete or return Customer Data and delete existing copies unless retention is required by law.
11. Contact
To request a signed copy of this DPA or to raise a data-protection question, contact privacy@forzelite.com.